Multiple Plug And Play Web Server FTP Service Command Handler Buffer Overflow Vulnerabilities
BID:8667
Info
Multiple Plug And Play Web Server FTP Service Command Handler Buffer Overflow Vulnerabilities
| Bugtraq ID: | 8667 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 21 2003 12:00AM |
| Updated: | Sep 21 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Bahaa Naamneh <[email protected]>. |
| Vulnerable: |
Plug and Play Web Server 1.0 002c |
| Not Vulnerable: | |
Discussion
Multiple Plug And Play Web Server FTP Service Command Handler Buffer Overflow Vulnerabilities
Plug and Play Web Server FTP service has been reported prone to multiple buffer overflow issues, the issues present themselves when the affected FTP service handles FTP command arguments of excessive size.
It has been demonstrated that a remote attacker may exploit this condition to trigger a denial of service in the affected FTP server. However, due to the nature of this vulnerability, although unconfirmed, it has been conjectured that a remote attacker may leverage this vulnerability to have arbitrary code executed in the context of the vulnerable service.
Plug and Play Web Server FTP service has been reported prone to multiple buffer overflow issues, the issues present themselves when the affected FTP service handles FTP command arguments of excessive size.
It has been demonstrated that a remote attacker may exploit this condition to trigger a denial of service in the affected FTP server. However, due to the nature of this vulnerability, although unconfirmed, it has been conjectured that a remote attacker may leverage this vulnerability to have arbitrary code executed in the context of the vulnerable service.
Exploit / POC
Multiple Plug And Play Web Server FTP Service Command Handler Buffer Overflow Vulnerabilities
The following proof of concept exploit has been supplied:
The following proof of concept exploit has been supplied:
Solution / Fix
Multiple Plug And Play Web Server FTP Service Command Handler Buffer Overflow Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple Plug And Play Web Server FTP Service Command Handler Buffer Overflow Vulnerabilities
References:
References:
- Plug & Play Web (FTP) Server Denial Of Service (B-Security)
- Web Server (Plug and Play)